342.rar
- SHA256 c77c4fbac35971aaa9fff14875555283d92c5d70d72b38dfb4700bc348292640
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Debug/net8.0-windows/9et.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
Debug/net8.0-windows/9et.exe
Resource
win11ltsc2024-20260710-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
Debug/net8.0-windows/9et.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral4
Sample
Debug/net8.0-windows/9et.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 342.rar
- Size 72KB
- Sample260718-sttgdaev5k
- SHA256 c77c4fbac35971aaa9fff14875555283d92c5d70d72b38dfb4700bc348292640
- MD5 03f6797f04659244a1aaaf781d15e8c9
- SHA1 39ff6ab77d83f9073f067068bc0d21ae725bfb80
- SHA512 d3c2f21e9a2bc122297e6456e56664b5c9504d25226dbbb69663434ddad65711abcbc712c93195e43f33e1d6da13de436571e1c6e13492fe7c25c614da5d32a3
- SSDEEP 1536:dYk5SoU+P7X+6c5p6sBQ0PdoTKUW+tWpfMdHdrADe6bvmA3TIUap:iQE+u5BbckpfIdrA6WvmQT5i
- TLSH T1197302E84062BFB9B35A2709C0867F12D6B227508B95D89714375F18E1BD10CB27FA6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/Debug/net8.0-windows/9et.dll unpack001/Debug/net8.0-windows/9et.exe
File Explorer
-
342.rar.rar 72KB
-
Debug/net8.0-windows/9et.deps.json401B
-
Debug/net8.0-windows/9et.dll.exe 13KB
-
Debug/net8.0-windows/9et.exe.exe 148KB
-
Debug/net8.0-windows/9et.pdb14KB
-
Debug/net8.0-windows/9et.runtimeconfig.json357B
Debug/net8.0-windows/9et.deps.json
- SHA256 c5f719bdf106a1779ae36db235af6385473d3dbf4dedd51a8fbbedf115c153ff
- MD5 50be2da0c501934fb8422441f67cbcce
- SHA1 c64c92dbf9ebf2e515d5d5102f03aea40d3b6c85
- SHA512 bfd2e7c3d9077bc2f41f49f72ee4c1023b124e6fb85aca0cf908c7e3126260b0adaf47ef584acf1a097ea03a02da85dbc02bf52308837f5e882247832ebbffd3
- TLSH T1D4E04F19D5940DAB01F223B65536C393F572573300251C1E79FE841C0F7695B9491F69
- MD5 SHA1 SHA512 TLSH
Debug/net8.0-windows/9et.dll
- IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
- SHA256 72c8c5c1e8cb753ec175a5d6929397be699454912e85de5c642dad08b588316f
- MD5 6f87a11f95cdef443faf249ad2905cb2
- SHA1 37d16f1819230a2ad99e05e55c0c8fed6bcf8878
- SHA512 f781d0263b1971b1ffea96a9410ac1b9e15935b2f738abaebfb04c97852ee200f1c5e1cf8ed010d16f7770a803040379b3a6fdb583335a92ffd9700423ef3538
- SSDEEP 384:xhOgzJXqde56KSZBqqXkj1IhVn5gIO2on4CpMKfe:blqdalAg3nHe
- TLSH T1D052E758FBD8C524D9395AB1EEF3D3244339B985DD62CF4F298A608B1A227445BA0F70
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
18610
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
C:\Users\ft305\Downloads\files (13)\tools\obj\Debug\net8.0-windows\9et.pdb
mscoree
_CorExeMain
Name
.text
Size
10KB
Virtual Size
10KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
12B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
dotnet
Debug/net8.0-windows/9et.exe
- IMPHASH bb3ac2c21e02c68abcad237dc3fa6d00
- SHA256 8b3eec1c36026d20e9047eb5851b649575d9d043d0123523ab8741ff5164b642
- MD5 4c07a9ffd4f6c223ac20428b974c6766
- SHA1 03d66c54b94af5c03fa2d5ddb9c2c3e7b7df4a28
- SHA512 d080f6d6b1677c2775c70b0aa34b2507c1afab447bffd2c7579cea4dd868f23fa196da7787b7d397f8d75a61f19d25e4d1e1a53f24fe656fb802932c818a7e7d
- SSDEEP 3072:sqeXA/4yIg9vkNPNu6H6xCYOiVUE265UJO:svgvkNFNaxmNE0J
- TLSH T103E33B07A2A851BDE1B7D679CD924D41FB7378598B71A7CF03504AB60E63BD0AE39302
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
72400
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FreeLibrary
LoadLibraryExW
OutputDebugStringW
FindFirstFileExW
EnterCriticalSection
GetFullPathNameW
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
GetEnvironmentVariableW
GetModuleHandleW
MultiByteToWideChar
GetFileAttributesExW
LoadLibraryA
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
GetProcAddress
GetWindowsDirectoryW
FindResourceW
GetLastError
ActivateActCtx
FindClose
CreateActCtxW
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetCurrentProcessId
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetStringTypeW
SwitchToThread
GetCurrentThreadId
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
QueryPerformanceCounter
GetSystemTimeAsFileTime
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_invoke_watson
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_errno
_initialize_onexit_table
abort
_c_exit
_register_thread_local_exe_atexit_callback
terminate
__p___wargv
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
_set_fmode
fputwc
__p__commode
fputws
_wfsopen
fflush
__stdio_common_vfwprintf
__stdio_common_vsnwprintf_s
__stdio_common_vswprintf
setvbuf
api-ms-win-crt-heap-l1-1-0
calloc
_set_new_mode
free
_callnewh
malloc
api-ms-win-crt-string-l1-1-0
wcsncmp
toupper
strcmp
strlen
_wcsdup
wcsnlen
strcpy_s
api-ms-win-crt-convert-l1-1-0
wcstoul
_wtoi
api-ms-win-crt-time-l1-1-0
wcsftime
_gmtime64_s
_time64
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
_configthreadlocale
___lc_codepage_func
___lc_locale_name_func
__pctype_func
_lock_locales
setlocale
_unlock_locales
api-ms-win-crt-math-l1-1-0
__setusermatherr
Name
.text
Size
89KB
Virtual Size
88KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
47KB
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
824B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
generic
count=10, id=259, version=35207,
count=12, id=260, version=35207,
count=87, id=261, version=35207,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=33145,
count=204, id=1, productName=Unmarked objects,
count=10, id=265, version=35223,
count=1, id=258, version=35223,
Debug/net8.0-windows/9et.pdb
- SHA256 2d1167deae86f41afb28d7f46329bb9d1f09efd1809cdccd625c2cf1cca8aefd
- MD5 f172608f45cfc474a39fee5d76ffdf3d
- SHA1 cd82524755cd3eabe6245b074a685b8d0677ccf0
- SHA512 191a03f7e3d90a9e41bfe5bbad4ac5050d4e7a30463fe0ad38142f03b5a93defc06a4d93ef01f2ffaffec4ced045628b38a71e9aea7ef12d3c99e2d004c096e4
- SSDEEP 384:uNhSbJskw6l4D7aIXzsZ1cBa17kG7KT7BirycN0aDj+0exHTfyv8G7ldfY+GlGKB:UhSb7kCs6rNFfYS5a
- TLSH T1A962B1779388D661C64626736936C38C3B7483142705FF79F2C42A48EEAF78903F6161
- MD5 SHA1 SHA512 SSDEEP TLSH
Debug/net8.0-windows/9et.runtimeconfig.json
- SHA256 a6a31e881a564ce497254b0cc044c32ade3cf5f02c6501e43c8425e8698b2c00
- MD5 35bc322bd42045632a8cb4fce81a90d2
- SHA1 351f78a6441ac2c8a34a03d92561000889260326
- SHA512 747651399d598da800d2d0090924b682bac3578c6718adf60cd6d99fa4f89ae8c343addb97476b64597c59007b2259fdc1a49380d7c33c8cfe220a30201ee718
- TLSH T192E08C3AC9144DA315F53BBED52AC287FE3047AB0158092AB6BC441C1F725625000F88
- MD5 SHA1 SHA512 TLSH